A legislative battle is under way over gaps that allow companies to collect and sell students’ personal information.